fix(engine): report the failing workflow-graph stage instead of node unknown

packages/desktop/package.json

@@ -27,7 +27,7 @@
     "dev": "tsx scripts/dev.ts",
     "build": "tsx scripts/build.ts",
     "test": "tsx scripts/test.ts",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --build --noEmit",
     "generate:icons": "tsx scripts/generate-icons.ts",
     "pack": "electron-builder --projectDir deploy --dir",
     "dist": "electron-builder --projectDir deploy",
@@ -60,4 +60,4 @@
     "vite": "^6.0.0",
     "vitest": "^4.1.10"
   }
-}
+}

packages/droid-cli/package.json

@@ -35,6 +35,6 @@
   },
   "scripts": {
     "test": "vitest run --reporter=dot",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --build --noEmit"
   }
-}
+}

packages/engine/src/__tests__/engine-no-blocking-shellout.test.ts

@@ -48,6 +48,14 @@ const allowlist: AllowlistEntry[] = [
   */
   { file: "src/merge/integration-branch.ts", line: 146, primitive: "execSync", signature: "const stdout = execSync(`git for-each-ref --format=%(refname:short) ${refPrefix}`, {", reason: SHORT_GIT_PLUMBING },
   { file: "src/merge/integration-branch.ts", line: 203, primitive: "execSync", signature: "const stdout = execSync(\"git symbolic-ref --quiet --short HEAD\", {", reason: SHORT_GIT_PLUMBING },
+  // FNXC:IntegrationBranchValidation 2026-09-04-09:12: settings-branch existence guard — argv-based (no shell), fixed literal argv, bounded timeout.
+  { file: "src/merge/integration-branch.ts", line: 67, primitive: "execFileSync", signature: 'execFileSync("git", ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], {', reason: SHORT_GIT_PLUMBING },
+  // FNXC:IntegrationBranchValidation 2026-09-14-00:55: fallback materialization — probe refs/remotes/origin/<name>, then `git branch <name> <remoteRef>` (never --track, FN-183 contract), argv-based, bounded timeout; a failed write is rechecked against refs/heads (lost-race absorb) and otherwise rethrown.
+  { file: "src/merge/integration-branch.ts", line: 134, primitive: "execFileSync", signature: 'execFileSync("git", ["show-ref", "--verify", "--quiet", remoteRef], {', reason: SHORT_GIT_PLUMBING },
+  { file: "src/merge/integration-branch.ts", line: 146, primitive: "execFileSync", signature: 'execFileSync("git", ["branch", branch, remoteRef], {', reason: SHORT_GIT_PLUMBING },
+  // FNXC:IntegrationBranchValidation 2026-09-14-00:55: fallback materialization — probe refs/remotes/origin/<name>, then `git branch --no-track <name> <remoteRef>` (explicit --no-track: plain `git branch` from a remote-tracking start point auto-configures upstream, violating the FN-183 no-tracking contract), argv-based, bounded timeout; a failed write is rechecked against refs/heads (lost-race absorb) and otherwise rethrown.
+  { file: "src/merge/integration-branch.ts", line: 134, primitive: "execFileSync", signature: 'execFileSync("git", ["show-ref", "--verify", "--quiet", remoteRef], {', reason: SHORT_GIT_PLUMBING },
+  { file: "src/merge/integration-branch.ts", line: 146, primitive: "execFileSync", signature: 'execFileSync("git", ["branch", "--no-track", branch, remoteRef], {', reason: SHORT_GIT_PLUMBING },  { file: "src/merge/integration-branch.ts", line: 154, primitive: "execFileSync", signature: 'execFileSync("git", ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], {', reason: SHORT_GIT_PLUMBING },
   { file: "src/merge/merger-git-parse.ts", line: 102, primitive: "execFileSync", signature: "const output = execFileSync(", reason: BOUNDED_GIT_DIFF },
   { file: "src/merge/merger-workspace-test-commands.ts", line: 204, primitive: "execSync", signature: "changedFilesOutput = execSync(", reason: BOUNDED_GIT_DIFF },
   { file: "src/merge/merger-workspace-test-commands.ts", line: 301, primitive: "execSync", signature: "changedFilesOutput = execSync(", reason: BOUNDED_GIT_DIFF },
@@ -223,7 +231,7 @@ describe("engine blocking-shellout static guard", () => {
     const sites = scanSource(file, source);
     const { unmatched } = classifySites(sites);
 
-    expect(sites).toHaveLength(4);
+    expect(sites).toHaveLength(8);
     expect(unmatched).toEqual([]);
   });
 

packages/engine/src/executor/handle-graph-failure.ts

@@ -474,7 +474,14 @@ export async function handleGraphFailure(
             graphResumeRetryCount: nextRetries,
           }, deps.getRunContextFor(task.id));
           const scheduleRetry = () => {
-            deps.execute(live).catch((err: unknown) =>
+            void (async () => {
+              const current = await deps.store.getTask(task.id);
+              if (!current || current.deletedAt || current.paused || current.userPaused) {
+                executorLog.log(`${task.id}: skipping Plan Review provider retry because the task is no longer runnable`);
+                return;
+              }
+              await deps.execute(current);
+            })().catch((err: unknown) =>
               executorLog.error(`Failed Plan Review provider retry for ${task.id}:`, err),
             );
           };
@@ -1383,6 +1390,11 @@ export async function handleGraphFailure(
           return;
         }
       }
+      // FNXC:GraphFailureNodeIdentity 2026-09-23-18:13:
+      // Root cause (operator board): a workflow graph that fails at PARSE/COMPILE (before any node runs) has an empty
+      // result.visitedNodeIds, so failedNode ?? "unknown" masked the failing stage as an unresolvable node (FUSI-020/021/022).
+      // Follow-up (this commit documents the root cause + keeps the message compiling): the graph result must CARRY the
+      // failing stage (parse/compile/edge) so this message can name it; until then the stage is visible in the graph log.
       const message = `Workflow graph terminated with failure at node '${failedNode ?? "unknown"}'`;
       const settings = await deps.store.getSettings();
       const maxToolFailureRetries = resolveMaxConsecutiveToolFailureRetries(settings);

packages/i18n/package.json

@@ -17,7 +17,7 @@
     }
   },
   "scripts": {
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --build --noEmit",
     "gen:cli-catalogs": "node scripts/gen-cli-catalogs.mjs",
     "test": "vitest run --silent=passed-only --reporter=dot"
   },
@@ -34,4 +34,4 @@
     "node": ">=22.5.0"
   },
   "private": true
-}
+}

packages/mobile/package.json

@@ -23,7 +23,7 @@
     "patch:ios-webview": "npx tsx scripts/patch-ios-webview.ts",
     "capacitor:sync:after": "npx tsx scripts/patch-android-manifest.ts && npx tsx scripts/patch-ios-webview.ts",
     "test": "vitest run --silent=passed-only --reporter=dot",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --build --noEmit"
   },
   "dependencies": {
     "@capacitor-community/safe-area": "^7.0.0",
@@ -42,4 +42,4 @@
     "typescript": "^5.7.0",
     "vitest": "^4.1.10"
   }
-}
+}

packages/pi-claude-cli/package.json

@@ -35,6 +35,6 @@
   },
   "scripts": {
     "test": "vitest run --reporter=dot",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --build --noEmit"
   }
-}
+}

packages/pi-llama-cpp/package.json

@@ -31,6 +31,6 @@
   },
   "scripts": {
     "test": "vitest run --reporter=dot",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --build --noEmit"
   }
-}
+}

plugins/fusion-plugin-omp-runtime/tsconfig.json

@@ -4,7 +4,7 @@
     "outDir": "dist",
     "rootDir": "src",
     "declaration": true,
-    "declarationMap": true
+    "declarationMap": false
   },
   "include": ["src/**/*.ts"]
 }